diff --git a/charts/kyverno/templates/clusterrole.yaml b/charts/kyverno/templates/clusterrole.yaml index ae9b6eea62..3cec33ff0f 100644 --- a/charts/kyverno/templates/clusterrole.yaml +++ b/charts/kyverno/templates/clusterrole.yaml @@ -194,4 +194,4 @@ rules: - reportchangerequests - clusterreportchangerequests verbs: - - "*" \ No newline at end of file + - "*" diff --git a/charts/kyverno/templates/policies/default/disallow-adding-capabilities.yaml b/charts/kyverno/templates/policies/default/disallow-adding-capabilities.yaml index 8c2218d08a..680a28f9cb 100644 --- a/charts/kyverno/templates/policies/default/disallow-adding-capabilities.yaml +++ b/charts/kyverno/templates/policies/default/disallow-adding-capabilities.yaml @@ -1,4 +1,4 @@ -{{ $name := "disallow-add-capabilities" -}} +{{- $name := "disallow-add-capabilities" }} {{- if eq (include "kyverno.podSecurityDefault" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy @@ -8,7 +8,7 @@ metadata: policies.kyverno.io/category: Pod Security Standards (Default) {{- if .Values.podSecuritySeverity }} policies.kyverno.io/severity: {{ .Values.podSecuritySeverity | quote }} - {{- end -}} + {{- end }} policies.kyverno.io/description: >- Capabilities permit privileged actions without giving full root access. Adding capabilities beyond the default set must not be allowed. @@ -36,4 +36,4 @@ spec: - =(securityContext): =(capabilities): X(add): null -{{- end -}} \ No newline at end of file +{{- end -}} diff --git a/charts/kyverno/templates/policies/default/disallow-host-namespaces.yaml b/charts/kyverno/templates/policies/default/disallow-host-namespaces.yaml index 114abbb0ea..59301ddf87 100644 --- a/charts/kyverno/templates/policies/default/disallow-host-namespaces.yaml +++ b/charts/kyverno/templates/policies/default/disallow-host-namespaces.yaml @@ -1,4 +1,4 @@ -{{ $name := "disallow-host-namespaces" -}} +{{- $name := "disallow-host-namespaces" }} {{- if eq (include "kyverno.podSecurityDefault" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy @@ -8,7 +8,7 @@ metadata: policies.kyverno.io/category: Pod Security Standards (Default) {{- if .Values.podSecuritySeverity }} policies.kyverno.io/severity: {{ .Values.podSecuritySeverity | quote }} - {{- end -}} + {{- end }} policies.kyverno.io/description: >- Host namespaces (Process ID namespace, Inter-Process Communication namespace, and network namespace) allow access to shared information and can be used to elevate diff --git a/charts/kyverno/templates/policies/default/disallow-host-path.yaml b/charts/kyverno/templates/policies/default/disallow-host-path.yaml index 4226495bbf..ed1418f5b3 100644 --- a/charts/kyverno/templates/policies/default/disallow-host-path.yaml +++ b/charts/kyverno/templates/policies/default/disallow-host-path.yaml @@ -1,4 +1,4 @@ -{{ $name := "disallow-host-path" -}} +{{- $name := "disallow-host-path" }} {{- if eq (include "kyverno.podSecurityDefault" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy @@ -8,7 +8,7 @@ metadata: policies.kyverno.io/category: Pod Security Standards (Default) {{- if .Values.podSecuritySeverity }} policies.kyverno.io/severity: {{ .Values.podSecuritySeverity | quote }} - {{- end -}} + {{- end }} policies.kyverno.io/description: >- HostPath volumes let pods use host directories and volumes in containers. Using host resources can be used to access shared data or escalate privileges diff --git a/charts/kyverno/templates/policies/default/disallow-host-ports.yaml b/charts/kyverno/templates/policies/default/disallow-host-ports.yaml index 3625f64348..c167ba569a 100644 --- a/charts/kyverno/templates/policies/default/disallow-host-ports.yaml +++ b/charts/kyverno/templates/policies/default/disallow-host-ports.yaml @@ -8,7 +8,7 @@ metadata: policies.kyverno.io/category: Pod Security Standards (Default) {{- if .Values.podSecuritySeverity }} policies.kyverno.io/severity: {{ .Values.podSecuritySeverity | quote }} - {{- end -}} + {{- end }} policies.kyverno.io/description: >- Access to host ports allows potential snooping of network traffic and should not be allowed, or at minimum restricted to a known list. diff --git a/charts/kyverno/templates/policies/default/disallow-privileged-containers.yaml b/charts/kyverno/templates/policies/default/disallow-privileged-containers.yaml index 5fb6cb4f24..1dfcc8cdcb 100644 --- a/charts/kyverno/templates/policies/default/disallow-privileged-containers.yaml +++ b/charts/kyverno/templates/policies/default/disallow-privileged-containers.yaml @@ -8,7 +8,7 @@ metadata: policies.kyverno.io/category: Pod Security Standards (Default) {{- if .Values.podSecuritySeverity }} policies.kyverno.io/severity: {{ .Values.podSecuritySeverity | quote }} - {{- end -}} + {{- end }} policies.kyverno.io/description: >- Privileged mode disables most security mechanisms and must not be allowed. spec: diff --git a/charts/kyverno/templates/policies/default/disallow-proc-mount.yaml b/charts/kyverno/templates/policies/default/disallow-proc-mount.yaml index 7cdc211410..9ab8447bff 100644 --- a/charts/kyverno/templates/policies/default/disallow-proc-mount.yaml +++ b/charts/kyverno/templates/policies/default/disallow-proc-mount.yaml @@ -8,7 +8,7 @@ metadata: policies.kyverno.io/category: Pod Security Standards (Default) {{- if .Values.podSecuritySeverity }} policies.kyverno.io/severity: {{ .Values.podSecuritySeverity | quote }} - {{- end -}} + {{- end }} policies.kyverno.io/description: >- The default /proc masks are set up to reduce attack surface and should be required. spec: diff --git a/charts/kyverno/templates/policies/default/disallow-selinux.yaml b/charts/kyverno/templates/policies/default/disallow-selinux.yaml index 8840409446..3ab24dde86 100644 --- a/charts/kyverno/templates/policies/default/disallow-selinux.yaml +++ b/charts/kyverno/templates/policies/default/disallow-selinux.yaml @@ -9,7 +9,7 @@ metadata: policies.kyverno.io/category: Pod Security Standards (Default) {{- if .Values.podSecuritySeverity }} policies.kyverno.io/severity: {{ .Values.podSecuritySeverity | quote }} - {{- end -}} + {{- end }} policies.kyverno.io/description: >- SELinux options can be used to escalate privileges and should not be allowed. spec: diff --git a/charts/kyverno/templates/policies/default/restrict-apparmor-profiles.yaml b/charts/kyverno/templates/policies/default/restrict-apparmor-profiles.yaml index 58b403415c..9449c3e1f2 100644 --- a/charts/kyverno/templates/policies/default/restrict-apparmor-profiles.yaml +++ b/charts/kyverno/templates/policies/default/restrict-apparmor-profiles.yaml @@ -1,4 +1,4 @@ -{{ $name := "restrict-apparmor-profiles" -}} +{{- $name := "restrict-apparmor-profiles" }} {{- if eq (include "kyverno.podSecurityDefault" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy @@ -9,7 +9,7 @@ metadata: policies.kyverno.io/category: Pod Security Standards (Default) {{- if .Values.podSecuritySeverity }} policies.kyverno.io/severity: {{ .Values.podSecuritySeverity | quote }} - {{- end -}} + {{- end }} policies.kyverno.io/description: >- On supported hosts, the 'runtime/default' AppArmor profile is applied by default. The default policy should prevent overriding or disabling the policy, or restrict diff --git a/charts/kyverno/templates/policies/default/restrict-sysctls.yaml b/charts/kyverno/templates/policies/default/restrict-sysctls.yaml index 12b6c8db08..e9aae27615 100644 --- a/charts/kyverno/templates/policies/default/restrict-sysctls.yaml +++ b/charts/kyverno/templates/policies/default/restrict-sysctls.yaml @@ -1,4 +1,4 @@ -{{ $name := "restrict-sysctls" -}} +{{- $name := "restrict-sysctls" }} {{- if eq (include "kyverno.podSecurityDefault" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy @@ -8,7 +8,7 @@ metadata: policies.kyverno.io/category: Pod Security Standards (Default) {{- if .Values.podSecuritySeverity }} policies.kyverno.io/severity: {{ .Values.podSecuritySeverity | quote }} - {{- end -}} + {{- end }} policies.kyverno.io/description: >- Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed "safe" subset. A diff --git a/charts/kyverno/templates/policies/restricted/deny-privilege-escalation.yaml b/charts/kyverno/templates/policies/restricted/deny-privilege-escalation.yaml index 4dd41ceba5..b2850b3f78 100644 --- a/charts/kyverno/templates/policies/restricted/deny-privilege-escalation.yaml +++ b/charts/kyverno/templates/policies/restricted/deny-privilege-escalation.yaml @@ -1,4 +1,4 @@ -{{ $name := "deny-privilege-escalation" -}} +{{- $name := "deny-privilege-escalation" }} {{- if eq (include "kyverno.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy @@ -8,7 +8,7 @@ metadata: policies.kyverno.io/category: Pod Security Standards (Restricted) {{- if .Values.podSecuritySeverity }} policies.kyverno.io/severity: {{ .Values.podSecuritySeverity | quote }} - {{- end -}} + {{- end }} policies.kyverno.io/description: >- Privilege escalation, such as via set-user-ID or set-group-ID file mode, should not be allowed. spec: diff --git a/charts/kyverno/templates/policies/restricted/require-non-root-groups.yaml b/charts/kyverno/templates/policies/restricted/require-non-root-groups.yaml index b1b43d8159..40e5d56ffb 100644 --- a/charts/kyverno/templates/policies/restricted/require-non-root-groups.yaml +++ b/charts/kyverno/templates/policies/restricted/require-non-root-groups.yaml @@ -1,4 +1,4 @@ -{{ $name := "require-non-root-groups" -}} +{{- $name := "require-non-root-groups" }} {{- if eq (include "kyverno.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy @@ -8,7 +8,7 @@ metadata: policies.kyverno.io/category: Pod Security Standards (Restricted) {{- if .Values.podSecuritySeverity }} policies.kyverno.io/severity: {{ .Values.podSecuritySeverity | quote }} - {{- end -}} + {{- end }} policies.kyverno.io/description: >- Containers should be forbidden from running with a root primary or supplementary GID. spec: diff --git a/charts/kyverno/templates/policies/restricted/require-run-as-nonroot.yaml b/charts/kyverno/templates/policies/restricted/require-run-as-nonroot.yaml index 8d140463f8..70e7dcb832 100644 --- a/charts/kyverno/templates/policies/restricted/require-run-as-nonroot.yaml +++ b/charts/kyverno/templates/policies/restricted/require-run-as-nonroot.yaml @@ -1,4 +1,4 @@ -{{ $name := "require-run-as-non-root" -}} +{{- $name := "require-run-as-non-root" }} {{- if eq (include "kyverno.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy @@ -8,7 +8,7 @@ metadata: policies.kyverno.io/category: Pod Security Standards (Restricted) {{- if .Values.podSecuritySeverity }} policies.kyverno.io/severity: {{ .Values.podSecuritySeverity | quote }} - {{- end -}} + {{- end }} policies.kyverno.io/description: Containers must be required to run as non-root users. spec: background: true diff --git a/charts/kyverno/templates/policies/restricted/restrict-seccomp.yaml b/charts/kyverno/templates/policies/restricted/restrict-seccomp.yaml index c7e171f255..1bc7ae63af 100644 --- a/charts/kyverno/templates/policies/restricted/restrict-seccomp.yaml +++ b/charts/kyverno/templates/policies/restricted/restrict-seccomp.yaml @@ -1,4 +1,4 @@ -{{ $name := "restrict-seccomp" -}} +{{- $name := "restrict-seccomp" }} {{- if eq (include "kyverno.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy @@ -9,7 +9,7 @@ metadata: policies.kyverno.io/category: Pod Security Standards (Restricted) {{- if .Values.podSecuritySeverity }} policies.kyverno.io/severity: {{ .Values.podSecuritySeverity | quote }} - {{- end -}} + {{- end }} policies.kyverno.io/description: >- The runtime default seccomp profile must be required, or only specific additional profiles should be allowed. diff --git a/charts/kyverno/templates/policies/restricted/restrict-volume-types.yaml b/charts/kyverno/templates/policies/restricted/restrict-volume-types.yaml index 189081c000..bdd6b3529d 100644 --- a/charts/kyverno/templates/policies/restricted/restrict-volume-types.yaml +++ b/charts/kyverno/templates/policies/restricted/restrict-volume-types.yaml @@ -1,4 +1,4 @@ -{{ $name := "restrict-volume-types" -}} +{{- $name := "restrict-volume-types" }} {{- if eq (include "kyverno.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy @@ -8,7 +8,7 @@ metadata: policies.kyverno.io/category: Pod Security Standards (Restricted) {{- if .Values.podSecuritySeverity }} policies.kyverno.io/severity: {{ .Values.podSecuritySeverity | quote }} - {{- end -}} + {{- end }} policies.kyverno.io/description: >- In addition to restricting HostPath volumes, the restricted pod security profile limits usage of non-core volume types to those defined through PersistentVolumes.